#clmel

Cisco Sourcefire Advanced Malware Protection (AMP)

BRKSEC-2664

Jay Tecksingani AMP CSE APJC

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Malware

• The Lure

• The Investigation

• Reasons for Success

• Simple Protection

• What’s been Missing ?

• Advanced Malware Protection

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

http://t...t.net/w p-content/plugins/jetpack/_inc/images/xblog/index2.php?id=2...0 (198…227 port 80).

http://auspost-portal.info/ (193…57 port 80)

http://auspost-package.net/unsubscribe.php?id=5...2

Typo’s - the obvious conclusion has long been “lost in translation”, however , INTENTIONAL Typos are meant to target unaware / distracted victims !

(attentive users will often delete these, causing no further concern to the criminals)

Stage #1: Compromise multitudes of WordPress WebSites - Setup Redirectors !

Stage #2: Register Multitudes of “similar” domain names through either Dynamic DNS or in different GEOs to TargetStage #3: Setup fast-flux domains in different GEOs to the Target Victim Base

The URLs used are often ONE-TIME use URLS , tied to recipient email addresses = Slowing down TakeDowns / InvestigationsRedirectors and Referrer IDs are often checked by the landing hosting Malware Server - to bypass investigative methods

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

194.58…/16

193.124…/16

AUSPOST-DELIVERY.COM

AUSPOST-DELIVERY.NETAUSPOST-EPARCEL.COM

AUSPOST-EPARCEL.NETAUSPOST-HOME.COMAUSPOST-HOME.NET

AUSPOST-PACKAGE.COMAUSPOST-PACKAGE.NET

AUSPOST-PARCEL.COMAUSPOST-PARCEL.NET

AUSPOST-PORTAL.NETAUSPOST-PORTAL24.NETAUSPOST-SERVICE.COM

AUSPOST-SERVICE.NETAUSPOST-SERVICES.COM

AUSPOST-SERVICES.NETAUSPOST-TRACK.NET

AUSPOST-TRACK24.NETAUSPOST-TRACKING.COMAUSPOST-TRACKING.NET

AUSPOST-TRACKING24.COMAUSPOST-TRACKING24.NET

AUSPOST-TRACKIT.COMAUSPOST-TRACKIT24.COM

AUSPOST-US.COM

ROYALMAIL-BELGIE.COM

ROYALMAIL-BELGIQUE.COMROYALMAIL-CSI.COM

ROYALMAIL-DELIVERY.COMROYALMAIL-DIRECT.COMROYALMAIL-DIRECT.NET

ROYALMAIL-ECOMMERCE.COMROYALMAIL-EMHS.COM

ROYALMAIL-EMHS.NETROYALMAIL-EPARCEL.COM

ROYALMAIL-EPARCEL.NETROYALMAIL-GROUP.COMROYALMAIL-GROUP.NET

ROYALMAIL-GROUPLTD.COMROYALMAIL-GROUPLTD.NET

ROYALMAIL-INTERNATIONAL.COMROYALMAIL-LUXEMBOURG.COM

ROYALMAIL-MAIDSTONE.COMROYALMAIL-PARCEL24.COMROYALMAIL-PARCEL24.NET

ROYALMAIL-PPI-LABELS.COMROYALMAIL-SERVICE.COM

ROYALMAIL-SERVICE.NETROYALMAIL-TRACKING.NET

ROYALMAIL-TRACKING24.COMROYALMAIL-TRACKING24.NET

193.124.94.2

Multiple domains registered @ orderbox-dns.com

Resolve to a few Subnets located in an address space allocated to Reg-RU = Moscow, Russia

The IP addresses reverse resolve to multiple domains, most notably ROYALMAIL

Royal Mail Services hit by CryptoLocker Scam earlier this year !

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

W e need to Track Tracks changes to the

following files

MSEXE, PDF, SCRIPT,HTML,HTML_UTF16,GRAPHICS,

TEXT_ASCII, TEXT_UTF8,

TEXT_UTF16LE, TEXT_UTF16BE,RTF,

RIFF,MSCHM,

MSCAB,MSOLE2,MSSZDD,ZIP,R AR,7Z ,BZ,GZ,ARJ,ZIPSFX,RARSFX,CABSFX,ARJ

SFX,NULSFT,AUTOIT,ISHIELD_M SI,SFX

BINHEX,MAIL,TNEF,BINARY_D ATA,CR Y

PTFF,UUENCODED,SCRENC,POSIX_TA

R,OLD_TAR,ELFMACHO,MACHO_UNIBIN,SIS,SWF,CPIO_OD,CPIO_N EWC,C PIO

_CRC

Crypto - affects several types of media,

graphics and document files

~ track undetected processes - that

otherwise continue to damage your system

!

Device File Trajectory clearly to show changes to multiple file types - that can be

affected by CryptoLocker

IOC is an advanced behavioural

methodology that can be used to flag data corruption and even exfiltration like activity

!

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Technologies We Use to Help us Fight Malware

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Cisco AMP Delivers A Better Approach

Retrospective SecurityPoint-in-Time Detection

Continuous ProtectionFile Reputation & Behavioural Detection

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

AMP is an Important Part of the Cisco Response

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Cisco AMP Defends With Retrospective Security

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

File Operations

Netw ork Operations

Capture Network Traffic Send TCP+UDP to Cloud

If Malicious Block

Capture File OperationGenerate

Fingerprint(SHA256)

Query Cloud for

Disposition

Send SHA256+Fuzzy Hash

to Cloud

Malicious = Block

Management Operations

Host Name Host IP Address

Heartbeat Login Name (Opt)

SSL Port 443

Port 32137

FireAMP Agent

Other components : libclamav, Tetra

The Messaging Subsystem:

The endpoint’s MAC and IP address

The user name

Execution privilege at the time of the detection

The SHA-256 of the offending file and parent process

The name of the parent and any child processes

The time of the event

The file type

Where the file was quarantined

The Ping2 Message

– a periodic “phone home”

It handles retrospective detection (a.k.a Cloud Recall™)

Handles policy updates

Detection Publishing –Detection

Custom signatures pushed to the endpoint connectors.

Cross referencing of files and signatures is done in the cloud

Self-updating, which limits endpoint/cloud communications

Large-scale data processing

File samples are provided to the cloud for processing

Low latency for detection

Advanced analytic engines

Uses machine-learning engines to refine signatures

Collective Intelligence

FireAMP customer data is not shared with any other entity

Decision making in real-time

Reporting

Remote File Fetch

Upload files from the clients on which they were seen to the cloud

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Combined Network-Based and Endpoint Malware Detection

• M Roesch

“ If you KNEW you were going to be compromised,

would you DO security differently?”

Advanced Malware Protection

Demo

Q & A

© 2015 Cisco and/or its affi liates. All rights reserved.BRKSEC-2664 Cisco Public

Give us your feedback and receive a

Cisco Live 2015 T-Shirt!

Complete your Overall Event Survey and 5 Session

Evaluations.

• Directly from your mobile device on the Cisco Live

Mobile App

• By visiting the Cisco Live Mobile Site

http://showcase.genie-connect.com/clmelbourne2015

• Visit any Cisco Live Internet Station located

throughout the venue

T-Shirts can be collected in the World of Solutions

on Friday 20 March 12:00pm - 2:00pm

Complete Your Online Session Evaluation

Learn online with Cisco Live! Visit us online after the conference for full

access to session videos and

presentations. www.CiscoLiveAPAC.com

Thank you.